d56e3f10522aa241e53be444844f91bf32bfb6178f1c9f4d36f52555e9cef60d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0144a06daedcb21dbc2352e9bdecf935_JaffaCakes118.html
Size

141KB
MD5

0144a06daedcb21dbc2352e9bdecf935
SHA1

7ac48ea16b55c148575de3b5200ca3f823159a97
SHA256

d56e3f10522aa241e53be444844f91bf32bfb6178f1c9f4d36f52555e9cef60d
SHA512

0a5e8d982d29343dcaa390169efbec3b315e611b6aeace569415571750aa762d023934a9b52ff17d8ab41eb5342c7dba10b35b8a3cbafe2af34708dd2879fece
SSDEEP

3072:SbWArBx7dyfkMY+BES09JXAnyrZalI+YQ:SbWArBx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
2080	msedge.exe
2080	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2448	2080	msedge.exe	80
PID 2080 wrote to memory of 2448	2080	msedge.exe	80
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4064	2080	msedge.exe	82
PID 2080 wrote to memory of 4544	2080	msedge.exe	83
PID 2080 wrote to memory of 4544	2080	msedge.exe	83
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84
PID 2080 wrote to memory of 2568	2080	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0144a06daedcb21dbc2352e9bdecf935_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83e1046f8,0x7ff83e104708,0x7ff83e104718
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1504,6438453998472171513,2625847899663131905,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,6438453998472171513,2625847899663131905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1504,6438453998472171513,2625847899663131905,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1504,6438453998472171513,2625847899663131905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1504,6438453998472171513,2625847899663131905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1504,6438453998472171513,2625847899663131905,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40e6646a9f7f68658ae4b334a3d1faff

SHA1
4be331b022f6937745e4237306e981ca4cb5e5d8

SHA256
bfe967abcb8027cd22534c0285c320c1e65c870a5df0ba95a10f416c8ab1508b

SHA512
82cd4dc78d86d997c864c64ea4e93bf5aefa87c1c48b6cc05aae097d05de4423d6d1ae1b7d115d48df7ae7939eeb94e1fc5471f56dfac2278882f845d19b2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8aa43d1075e78785531d81cde4634e20

SHA1
e18a54b62990864e09c65b319e877ca0f73b7a8c

SHA256
826e637727322437c83ffb8c86a057aa73c7710e6d0fbeb2f852e8e4c3098adc

SHA512
091e44928518563518d46700822b96b5d62db1dbba02e9aa933d41033691abb125a9da1f2feecf1f52976789ea6971ff7642795b8fddb76eca0567861a49b529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c19b7ffb195a41b1d9d57609c3101836

SHA1
4d127c26c43f3e9c5781350494c8d2b167bbf4d2

SHA256
53cefc8774e67cba2aad6421142726e145e895dd0fc7d35084275f5ea359b31b

SHA512
13db310d47bd979ed418d628cd91bd9a09c7d95ddf0df0a04f5e1648e8a6a32f7dafac04e35d756560a0154b4c8b6f9c3be4094fc374b892c1c6ee69d45178d7

Download Submit